Freedom251 › IDE Code Security Plugins
JFrog Xray
What JFrog Xray is
JFrog Xray is a software composition analysis tool for identifying, prioritizing, and remediating vulnerabilities and open-source license compliance issues. It continuously scans repositories, build packages, and container images, and can recursively scan CI build information before returning findings to a CI server. Xray generates, imports, and exports SBOMs, including CycloneDX, and supports license policies and compliance reports. It can assess operational risk using factors such as component age, contributor count, maintenance cadence, commits, and end-of-life status. JFrog says its database covers more than 4 million open-source packages for detecting malicious components. The service integrates with Artifactory, offers CLI scans and IDE plugins, and supports more than 25 package types, including Maven, npm, PyPI, NuGet, Docker, Helm, and Terraform State. Policies and watches can trigger alerts or other actions. Deployment options include SaaS and self-hosted installations.
Who it suits
Xray suits organizations managing open-source and third-party components across many package ecosystems. It is relevant to security, development, and CI teams needing SBOMs, policy enforcement, and vulnerability remediation.
What it does well
- Continuous repository and container scanning
- SBOM generation and CycloneDX support
- More than 25 package technologies
- Artifactory and CI integrations
- IDE plugins and CLI scans
What to know first
- Paid product with no free plan
- Enterprise X SaaS starts at $950.00 USD monthly
- Self-hosted Pro X starts at $27,000.00 USD yearly
- Enterprise+ pricing is custom
Limits
There is no free plan. Enterprise X SaaS includes 125 GB base monthly consumption and 30 projects at $950 a month; Pro X self-hosted includes one server at $27,000 a year. Enterprise X self-hosted includes three servers and 30 projects at $51,000 a year.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Pro X (self-hosted) | Starting at $27,000 / Year · 1 Server · 24/7 SLA Support | $27,000 a year |
| Enterprise X (self-hosted) | Starting at: $51,000 / Year · 3 Servers · 30 projects · 24/7 SLA Support | $51,000 a year |
| Enterprise X (SaaS) | Starting at: $950 / Month · 125 GB base monthly consumption · 30 projects · 99.9% uptime · 24/7 SLA Support | $950 a month |
| Enterprise+ | Custom Pricing: Let's Talk · SaaS: custom consumption · Self-hosted: 6 servers · High Touch Support | On request |
As jfrog.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Start the 30-day trial or choose a listed paid subscription
- Select SaaS or a self-hosted deployment
- For self-hosting, install with Helm, Docker Compose, RPM, Debian, or a Linux archive
- Connect repositories, build packages, container images, or CI build information
- Integrate Artifactory, supported IDE plugins, or CLI scans
- Configure policies and watches for alerts and actions
Verdict
JFrog Xray combines software composition analysis, SBOM handling, license controls, and operational-risk signals across a wide ecosystem range. Its listed plans span SaaS and self-hosted deployments, with a 30-day trial available.
Questions
Is JFrog Xray free?
No. It is a paid product with a 30-day trial and no free plan.
Which platforms and deployments are available?
Xray is listed for API, self-hosted, and web use. Self-hosted installations can run as a single node or high-availability deployment.
What does Enterprise X SaaS cost?
Enterprise X SaaS starts at $950 a month and includes 125 GB base monthly consumption, 30 projects, 99.9% uptime, and 24/7 SLA Support.
What does Pro X self-hosted cost?
Pro X self-hosted starts at $27,000 a year and includes one server and 24/7 SLA Support.
Which ecosystems does Xray support?
Listed ecosystems include Go, PHP, Maven, Gradle, npm, NuGet, PyPI, RubyGems, Rust, Docker, OCI, Helm, Terraform State, and others.
Does Xray generate SBOMs?
Yes. It generates SBOMs and supports ingesting and exporting SBOMs, including CycloneDX.
Facts from JFrog Xray's own pages
- Artifactory integration
- Xray integrates with Artifactory and shares metadata to help assess security issues and remediation scope. · jfrog.com, 9 Oct 2026
- Availability
- JFrog states its SaaS Xray offering has a 99.99% uptime SLA and self-managed deployments can use high availability clusters. · jfrog.com, 9 Oct 2026
- CI/CD
- Xray can scan CI build information recursively and return vulnerability findings to the calling CI server. · docs.jfrog.com, 9 Oct 2026
- Continuous scanning
- Xray continuously scans repositories, build packages, and container images throughout the development cycle. · jfrog.com, 9 Oct 2026
- Developer tools
- Xray offers IDE plugins including for VS Code, IntelliJ, Visual Studio, and PyCharm, and supports CLI scans. · jfrog.com, 9 Oct 2026
- Founded
- 2008 · jfrog.com, 28 Sept 2026
- Headquarters
- Netanya, Israel · jfrog.com, 28 Sept 2026
- Malicious packages
- JFrog says Xray uses an extended database of over 4 million open source packages to detect malicious packages and components. · jfrog.com, 9 Oct 2026
- Operational risk
- Xray can assess operational risk factors such as component age, contributor count, maintenance cadence, commits, and end-of-life status. · jfrog.com, 9 Oct 2026
- Plan availability
- JFrog states Xray is included with SaaS or self-hosted Pro X, Enterprise X, and Enterprise+ subscriptions. · jfrog.com, 9 Oct 2026
- Policy enforcement
- Xray policies and watches can flag risky components and trigger alerts or other actions. · docs.jfrog.com, 9 Oct 2026
- Purpose
- JFrog Xray is an SCA tool for identifying, prioritizing, and remediating vulnerabilities and license compliance issues in open source software and third-party components. · jfrog.com, 9 Oct 2026
- SBOM and licenses
- Xray generates SBOMs and supports policies and compliance reports for open source licenses. · jfrog.com, 9 Oct 2026
- SBOM formats
- Xray supports ingesting and exporting SBOMs, including CycloneDX. · docs.jfrog.com, 9 Oct 2026
- Supported deployment
- Self-hosted Xray can be installed as a single node or high-availability deployment using Helm, Docker Compose, RPM, Debian, or a Linux archive. · docs.jfrog.com, 9 Oct 2026
- Supported technologies
- Xray supports over 25 package types and technologies, including Docker, Maven, PyPI, npm, and NuGet. · jfrog.com, 9 Oct 2026
Where JFrog Xray stands on Freedom251
- IDE Code Security Plugins#10 of 19
- Dependency Management Software#20 of 27
- Software Composition Analysis Software#53 of 65